CXone client_credentials token endpoint returning 401

Trying to grab an access token from CXone using client_credentials. The docs say to POST to /v2/oauth2/token, but I keep hitting a 401 Unauthorized. Here’s the fetch call:

fetch('https://api.nicecxone.com/v2/oauth2/token', {
 method: 'POST',
 headers: { 'Authorization': 'Basic ' + btoa(`${clientId}:${clientSecret}`) },
 body: 'grant_type=client_credentials'
})

I’ve verified the creds work in Postman. Is the Basic auth header format wrong for this endpoint?